AiTM Proxy Relay of Authentication and Session Data

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•4

Detects anomalous web session traffic that proxies enterprise authorization endpoints (e.g., oauth, saml, login) while simultaneously interacting with session-related cookies. This behavior is indicative of an Adversary-in-the-Middle (AiTM) proxy setup used to capture session tokens and bypass authentication.